feat(site): search every AgenTrust site from the top bar

[imran-siddique]

Until now each AgenTrust docs site could only be searched from its own search box, on its own host, and agentrust-io.com could not be searched at all. A reader looking for "key release" had to guess which of eight sites held it.

Imran chose a live fetch with no build step, and a Search entry in the shared top bar on every site.

How it works

• search/index.html fetches each MkDocs site's search/search_index.json when the page opens. All seven send Access-Control-Allow-Origin: *. Measured 2026-09-14: wcm 48 KB, manifest 728 KB, cmcp 547 KB, ca2a 267 KB, trace 574 KB, tests 88 KB, governance 43 KB, 2,349,646 bytes in all. Fetched in parallel from this machine, the seven arrived in 496 ms wall clock.
• The hub has no MkDocs index, so the page reads sitemap.xml and fetches its 11 canonical pages (203,573 bytes), taking the title, description, main text and each section[id] heading.
• search/search.js matches in the browser. Every query word must appear. A word in a title or page title scores 10, each of up to three in the text scores 1, the whole query as a phrase adds 15 in a title or 5 in the text, and a page beats its own sections by 3. One page contributes at most two results, and the list stops at 50.
• Filter chips (All, WCM, Manifest, cMCP, cA2A, TRACE, Tests, Governance, AgenTrust hub) and the query live in the URL as ?q= and ?site=. Arrow keys move between results, and a source that fails to load is named in the status line while the rest are still searched.
• Source text is written only with textContent, text nodes and <mark> elements built by the script. Indexes are cached in sessionStorage for the visit when they fit.
• The page is noindex, follow, so it stays out of the sitemap. Without JavaScript it links each site's own search.

Top bar. supernav.js adds Search after Governance on every site. From a docs site the link carries ?site= for that site, including tests. On agentrust-io.com pages / opens search; the MkDocs sites keep their own / and s shortcuts.

Version. supernav.js changed, so CSS_VERSION moves from 21 to 22 and every hub page now loads ?v=22. The seven docs repos need the same bump in mkdocs.yml, in follow-up PRs; until they deploy, the availability check reports them lagging.

Availability check. The docs-host version probe now requests each home page with a throwaway ?availability=<time> query. On 2026-09-14 https://trace.agentrust-io.com/ returned HTML last modified at 21:01 (Age 426) with unversioned design-system.css and supernav.js, while ?v=<timestamp> returned v=21 for both, so the check reported trace as lagging when it was not. The plain 200 probes still use the bare URLs.

Limits

• The first search in a visit downloads about 2.3 MB of indexes, plus about 200 KB of hub pages.
• Results are only as fresh as each site's deployed index, and hub page text is fetched on every visit.
• Ranking is term matching and the weights above, nothing more. Under All, results take each site's best remaining hit in turn, strongest site first in every round, so "attestation" now shows all eight sources in the first 8 results and 7 each from Manifest, TRACE, cMCP, cA2A, Tests and WCM in the first 50, where WCM had none before.

Checked

• node search/search.test.js, now in the House style workflow: HTML and entity stripping, tokenizing, the all-terms rule, ranking order, the per-page cap, a weaker site appearing in the first round under All while a single-site filter keeps score order, URLs per host, and a title carrying <img src=x onerror=alert(1)> rendered as text through a DOM stub that throws if innerHTML is written.
• build-header.py --check (13 pages), build-controls.py --check, build-discovery.py --check, check-site.py (44 pages, 751 local links), check-discovery.py, check-dashes.js, marketplace.test.js, check-tdx-verifier.mjs, render-adoption.mjs --check and wcm/redirect.test.js pass.
• Headless Chrome against a local server with live indexes. ?q=attestation searched 2,314 entries from 8 of 8 sites: first 50 results, Manifest 7, TRACE 7, cMCP 7, cA2A 7, Tests 7, WCM 7, hub 6, Governance 2, with one from each source in the first 8. ?q=attestation&site=wcm gave 18, all WCM. ?q=key+release gave 44 across all eight sources with WCM first. A nonsense query shows the no-results message. A query with <script> produced no markup.
• Screenshots at 1400 wide and inside a 400px frame: chips wrap on a phone, and long URLs break instead of overflowing.
• check-availability.py live: 43/43 HTTP probes pass, and 0/7 docs hosts at v=22, each reported at v=21. That shows the cache-busted probe now reads the deployed ?v=21 pages.

Generated with Claude Code

https://claude.ai/code/session_013aK3gVWzNdcM3hZ2o2awK2